The stored data in a mask-programmed ROM (MROM) may be highly sensitive data relating to encryption codes or operating parameters. For example, an MROM may store important program code, the basic bootstrapping firmware for a main processor, or the firmware needed to internally control self-contained devices such as graphic cards, hard disks, DVD drives, and TFT screens. It is thus desirable for an MROM to be relatively secure against unauthorized access to its stored data.
The type of mask programming step in an MROM affects its data security. For example, one type of MROM involves the use of a metal layer programming step. Although metal layer programing is quite popular, a sophisticated user may readily reverse engineer the metal layer programming to recover the stored data. For example, a system on a chip (SOC) die that includes embedded MROMs is typically flip-chip mounted onto a package substrate. The active surface for the die with its adjacent metal layers thus faces the package substrate whereas the die's back surface is encapsulated with a mold compound. A reverse engineer may then readily remove the mold compound to expose the die's back surface and image through the exposed die using an electron microscope so as to read the metal layer programming and determine the stored data. The state of metal-layer fuses in fuse-based ROMs may also be recovered using this scanning electron microscope technique.
Another type of MROM uses a channel programming step to selectively provide a channel implant to corresponding memory cell transistors. Depending upon the presence of the channel implant, a memory cell transistor comprises either a high threshold voltage transistor or a low threshold voltage transistor. Ideally, a low threshold voltage transistor memory cell will conduct in response to an assertion of its corresponding word line whereas a high threshold voltage transistor will not. Although channel implants are robust to the type of reverse engineering used to examine metal layer programming, the difference between the high threshold voltage and the low threshold voltage reduces to as little as 100 millivolts as transistor dimensions push into the deep sub-micron regime. Both the low threshold voltage transistors and the high threshold voltage transistors will thus respond to the assertion of the word line at the advanced process nodes such that a separate reference circuit is required to differentiate the high threshold voltage memory cells from the low threshold memory cells, which reduces density and increases system complexity. Furthermore, the low threshold voltage memory cell transistors in channel-implant-programmed MROMs suffer from excessive leakage current.
Accordingly, there is a need in the art for mask programmable ROMs that are robust to unauthorized access yet achieve increased density and reduced power consumption.